DKIM is... not foolproof. It does not stop attackers from faking the visible "From" address. Which still works as phishing vector.